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CLAIMS 



What is claimed is: 

1 . A method for characterizing a network connection comprising: 

receiving parameters that specify a network connection; 

receiving state variable information pertaining to the network connection according to 
the parameters; 

sensing when the network connection is initiated according to the received state 

variable information; and 
storing the state variable information. 

2. The method of Claim 1 wherein receiving state variable information comprises: 

conveying to a protocol engine a parameter including at least one of a protocol 

identifier, a source address, a source port, a destination address and a destination 
port; and 

receiving from the protocol engine a state variable for the network connection 
according to the parameter. 

3. The method of Claim 1 wherein sensing when the network connection is initiated 
comprises monitoring the value of a state variable indicative of the connection state of the 
connection. 

4. The method of Claim 1 wherein sensing when the network connection is initiated 
comprises monitoring the value of a TCP/IP state variable called "STATE". 

5. The method of Claim 1 further comprising: 

sensing when the network connection terminates according to the state variable 
information; 

retrieving stored state variable information according to the network connection after 

the network connection terminates; and 
creating a history of the network connection according to the state variable 

information. 
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6. The method of Claim 5 wherein creating a history of the network connection comprises: 

developing a network connection profile from the state variable information; and 
creating a history of the network connection profile. 

7. The method of Claim 6 wherein creating a history of the network connection profile 
comprises detecting an exceptional event. 

8. The method of Claim 7 further comprising analyzing the exceptional event. 

9. The method of Claim 1 further comprising: 

retrieving the state variable information while the network connection continues; and 
making the state variable information available on a periodic basis. 

10. The method of Claim 9 further wherein making state variable information available 
comprises: 

creating a dynamic profile of the network connection according to the state variable 

information; and 
making the dynamic profile available on a periodic basis. 

1 1 . A network connection analysis unit capable of characterizing a network connection, said 
network connection analysis unit comprising: 

supervisor comprising: 

command register capable of receiving parameters that specify a network 
connection, and 

source address register capable of receiving an address referencing the 

location of state variables in a state memory; 
supervisory controller capable of: 



directing a state variable request to a protocol engine according to the 
parameters; 



sensing when the network connection is initiated by monitoring a 
location in the state memory as referenced by the contents of the 
source address register, and 
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first computer readable medium controller capable of directing a plurality of 
state variables from the state memory to a computer readable medium 
when the network connection is initiated. 

12. The network connection analysis unit of Claim 1 1 wherein the command register 
generates parameters including at least one of a protocol identifier, a source address, a 
source port, a destination address and a destination port and wherein the controller is 
further capable of loading into the source address register a memory reference received 
from a protocol engine. 

13. The network connection analysis unit of Claim 1 1 wherein the state memory referenced 
by the source address register contains an indictor of activity of the network connection. 

14. The network connection analysis unit of Claim 1 1 wherein the state memory referenced 
by the source address register contains a TCP/IP state variable called "STATE". 

15. The network connection analysis unit of Claim 1 1 further comprising an off-line 
connection analyzer comprising: 

off-line command register capable of receiving an off-line analysis request that 

includes a connection specifier; 
off-line computer readable medium controller capable of retrieving state variables 

from a computer readable medium according to the connection specifier; 
format table capable of converting the state variables into a print stream; 
off-line analysis controller capable of causing the second computer readable medium 

controller to retrieve state variables and further capable of directing the retrieved 

state variables to the format table. 

16. The network connection analysis unit of Claim 15 wherein format table includes a profile 
description that correlates one or more state variables to a connection profile. 

17. The network connection analysis unit of Claim 16 wherein the off-line connection 
analyzer further comprises an exceptional event detector capable of detecting an 
exceptional event. 
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18. The network connection analysis unit of Claim 17 wherein the exceptional event detector 
is capable of analyzing the exceptional event. 

19. The network connection analysis unit of Claim 1 1 further comprising a real-time 
connection analyzer comprising: 

real-time command register capable of receiving an real-line analysis request that 

includes a connection specifier; 
real-time computer readable medium controller capable of retrieving state variables 

from a computer readable medium according to the connection specifier; and 
display subsystem capable of generating a display signal according to the retrieved 

state variables. 

20. The network connection analysis unit of Claim 19 wherein the display subsystem 



profile generator capable of creating a profile of a network connection. 

21. A network connection analysis system comprising: 
memory capable of storing instructions; 

processor capable of executing instructions stored in the memory; and 

network connection characterization instruction sequence that, when executed by the 



processor, minimally causes the processor to: 

receive parameters that specify a network connection; 

receive state variable information pertaining to the network connection 

according to the parameters; 
sense when the network connection is initiated according to the received state 

variable information; and 
store the state variable information. 



22. The network connection analysis system of Claim 21 wherein the network connection 
characterization instruction sequence includes a state variable information receiver 
instruction sequence that, when executed by the processor, causes the processor to receive 
state variable information by minimally causing the processor to: 

convey to a protocol engine a parameter including at least one of a protocol identifier, 



comprises: 



a source address, a source port, a destination address and a destination port; and 
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receive from the protocol engine state variables for the network connection according 



23. The network connection analysis system of Claim 21 wherein the network connection 
characterization instruction sequence causes the processor to sense when the network 
connection has been initiated by minimally causing the processor to monitor the value of 
a state variable that is indicative of the connection state of the connection. 

24. The network connection analysis system of Claim 21 wherein the network connection 
characterization instruction sequence causes the processor to sense when the network 
connection has been initiated by minimally causing the processor to monitor the value of 
a TCP/IP state variable called "STATE". 

25. The network connection analysis system of Claim 21 further comprising an off-line 
connection analysis instruction sequence that, when executed by the processor, minimally 
causes the processor to: 

sense when the network connection terminates according to the state variable 
information; 

retrieve stored state variable information after the network connection terminates; and 
create a history of the network connection according to the state variable information. 

26. The network connection analysis system of Claim 25 wherein the off-line connection 
analysis instruction sequence comprises a network connection profile creation instruction 
sequence that, when executed by the processor, causes the processor to create a history by 
minimally causing the processor to: 

develop a network connection profile from the state variable information; and 
create a history of the network connection profile. 

27. The network connection analysis system of Claim 26 wherein the network connection 
profile creation instruction sequence comprises an exceptional event detection instruction 
sequence that, when executed by the processor, minimally causes the processor to detect 
an exceptional event. 



to the parameter. 
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28. The network connection analysis system of Claim 27 wherein the network connection 
profile creation instruction sequence further comprises an exceptional event analysis 
instruction sequence that, when executed by the processor, minimally causes the 
processor to analyze the exceptional event. 

29. The network connection analysis system of Claim 21 further comprising: 

display driver capable of generating a display signal; and 
real-time connection analysis instruction sequence that, when executed by the 
processor, further minimally causes the processor to: 

retrieve the state variable information while the network connection continues; 
and 

direct the state information to the display driver. 

30. The network connection analysis system of Claim 29 wherein the real-time connection 
analysis instruction sequence comprises a dynamic profile generation instruction 
sequence that, when executed by the processor, minimally causes the processor to: 

create a dynamic profile of the network connection according to the state variable 

information; and 
direct the dynamic profile to the display driver. 

3 1 . A computer-readable medium having computer-executable functions for characterizing a 
network connection comprising: 

network connection characterization instruction sequence that, when executed by a 



processor, minimally causes the processor to: 

receive parameters that specify a network connection; 

receive state variable information pertaining to the network connection 

according to the parameters; 
sense when the network connection is initiated according to the received state 

variable information; and 
store the state variable information. 



32. The computer-readable medium of Claim 31 wherein the network connection 

characterization instruction sequence includes a state variable information receiver 
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instruction sequence that, when executed by a processor, causes the processor to receive 
state variable information by minimally causing the processor to: 

convey to a protocol engine a parameter including at least one of a protocol identifier, 

a source address, a source port, a destination address and a destination port; and 
receive from the protocol engine state variables for the network connection according 
to the parameter. 

33. The network connection analysis system of Claim 31 wherein the network connection 
characterization instruction sequence causes the processor to sense when the network 
connection has been initiated by minimally causing the processor to monitor the value of 
a state variable that is indicative of the connection state of the connection. 

34. The network connection analysis system of Claim 31 wherein the network connection 
characterization instruction sequence causes the processor to sense when the network 
connection has been initiated by minimally causing the processor to monitor the value of 
a TCP/IP state variable called "STATE". 

35. The computer-readable medium of Claim 31 further comprising an off-line connection 
analysis instruction sequence that, when executed by a processor, minimally causes the 
processor to: 

sense when the network connection terminates according to the state variable 
information; 

retrieve stored state variable information after the network connection terminates; and 
create a history of the network connection according to the state variable information. 

36. The computer-readable medium of Claim 35 wherein the off-line connection analysis 
instruction sequence comprises a network connection profile creation instruction 
sequence that, when executed by a processor, causes the processor to create a history by 
minimally causing the processor to: 

develop a network connection profile from the state variable information; and 
create a history of the network connection profile. 

37. The computer-readable medium of Claim 36 wherein the network connection history 
profile instruction sequence comprises an exceptional event detection instruction 
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sequence that, when executed by a processor, minimally causes the processor to detect an 
exceptional event. 

38. The computer-readable medium of Claim 37 wherein the network connection profile 
creation instruction sequence further comprises an exceptional event analysis instruction 
sequence that, when executed by a processor, minimally causes the processor to analyze 
the exceptional event. 

39. The computer-readable medium of Claim 31 further comprising a real-time connection 
analysis instruction sequence that, when executed by a processor, further minimally 
causes the processor to: 

retrieve the state variable information white the network connection continues; and 
direct the state information to a display driver. 

40. The computer-readable medium of Claim 39 wherein the real-time connection analysis 
instruction sequence comprises a dynamic profile generation instruction sequence that, 
when executed by a processor, minimally causes the processor to: 

create a dynamic profile of the network connection according to the state variable 

information; and 
direct the dynamic profile to the display driver. 

41. A network connection analysis apparatus comprising: 

means for receiving state variable information pertaining to the network connection 

according to a set of received network parameters; 
means for sensing initiation of the network connection according to the received state 

variable information; and 
means for storing the state variable information. 

42. The network connection analysis apparatus of Claim 41 wherein the state variable 
information receiving means comprises: 

means for conveying to a protocol engine a parameter including at least one of a 
protocol identifier, a source address, a source port, a destination address and a 
destination port; and 
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means for receiving from the protocol engine a state variable for the network 
connection according to the parameter. 

43. The network connection analysis apparatus of Claim 41 wherein the means for sensing 
initiation of the network connection comprise a means for monitoring the value of a state 
variable indicative of the connection state of a network connection. 

44. The network connection analysis apparatus of Claim 41 wherein the means for sensing 
initiation of the network connection comprise a means for monitoring the value of a 
TCP/IP state variable called "STATE". 

45. The network connection analysis apparatus of Claim 41 further comprising: 

means for sensing when the network connection terminates according to the state 

variable information; 
means for retrieving stored state variable information according to the network 

connection after the network connection terminates; and 
means for creating a history of the network connection according to the state variable 

information. 

46. The network connection analysis apparatus of Claim 45 wherein means for creating a 
history of the network connection comprises: 

means for developing a network connection profile from the state variable 

information; and 
means for creating a history of the network connection profile. 

47. The network connection analysis apparatus of Claim 46 wherein means for creating a 
history of the network connection profile comprises means for detecting an exceptional 
event. 

48. The network connection analysis apparatus of Claim 47 further comprising means for 
analyzing the exceptional event. 

49. The network connection analysis apparatus of Claim 41 further comprising: 

means for retrieving the state variable information while the connection continues; 
and 
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means for making the state variable information available on a periodic basis. 

50. The network connection analysis apparatus of Claim 49 wherein means for making the 
state variable information available comprises: 

means for creating a dynamic profile of the network connection according to the state 

variable information; and 
means for making the dynamic profile available on a periodic basis. 
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